QMS Guidance Pt. 7 – ISO 9001 Clause 8.4
More ISO clause title bloat, clauses 8.4.1, 8.4.2 & 8.4.3 taken together are actually titled ‘Control of externally provided processes, products and services’ or to you and me Purchasing!
Sub-Clauses 8.4.1 & 8.4.2
These two sub-clauses can effectively be dealt with as one since they are telling you about the levels of control you’ll have to exercise over suppliers. The suppliers in question might be providing you with products, services or are a contractor. The standard makes it clear that you only have to worry about those suppliers who provide inputs into the product or service you’ll be providing to your customers or could make a significant dent in your capabilities if they just stopped supplying what you need. So no, you don’t have to worry about the sandwich shop that provides the lunch for the external auditor or the company that supplies your janitorial supplies.
The simplified version of what the standard says is, make a list of all those business critical suppliers (even if there’s more than one of them for a product or service), next you’ll have to figure out a way of evaluating how well they perform. Once you’ve got this you’ll have to assign someone the task of monitoring their performance and finally decide what you’re going to do if what they’ve supplied doesn’t meet your needs.
Its probably worth mentioning that when you get to clause 9.3.2 management review inputs, that performance of external providers is something that’s going to have to be reviewed. So putting some effort in will make all the difference at the review stage.
The standard makes no mention of a documented procedure or an approved suppliers list but I cannot recommend strongly enough having both (and if I were your consultant I’d put them all in the same document so there’s no confusion about what to do, when for and what procedure to follow).
Of real importance is the need to verify that products and services you’ve purchased do actually meet your requirements. In most companies I’ve worked with this is normally done at goods-in and amounts to checking what’s on the delivery note against what’s actually turned-up, evidenced by a signature and date, and in most cases this will suffice. BUT if what you’re making has some statutory or regulatory aspect over-laid then this probably isn’t going to cut it. You’re probably going to need to do some pre-use qualification testing and again some documenting what you’ve found.
As far as documentation required by the standard is concerned you’ll have to document all of these activities and any actions you deem necessary that come about after your evaluation.
This clause is asking you to communicate your needs to your supplier, again the standard is silent on method but normally this is in the form of a purchase order (PO). The PO must include the processes, products and services to be provided. This is the ‘must do’ part of this sub-clause, the rest of it is optional, to be used if necessary.
Its probably a fair assumption that most auditors (certainly new auditors) miss this distinction. The need to include things like competence of the supplier, or verification and validation at the suppliers premises are only needed if you really believe they are necessary. Then you include these aspects in the PO and when you come to auditing then you can check-up on what’s actually happens and report accordingly.
The Key Take-Aways
Take-Away # 1 – once you’ve evaluated and decided on who your trusted suppliers are you have an easy to use ‘go to’ list meaning non-conformity should be reduced
Take-Away # 2 – you will have provided sufficient information on your PO so your supplier can provide what you need, not only is this good practice but provides a good base for when things go wrong, you either asked for something or you didn’t
Take-Away # 3 – you can treat different suppliers with differing levels of control, some may only need basic information and others providing complex parts, processes or services may need closer and further reaching control to make sure you can meet your customers needs
Take-Away # 4 – ensuring your goods-in inspections are carried out and are detailed enough then coupled with good internal communications means you shouldn’t find any surprises about low stock levels and the such later on
Take-Away # 5 – good supplier evaluation can sometimes flag up early on a decline in standards allowing you time to pull things around before the point of failure, good for your business and good for the supplier too